Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [encoding]

Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

2
votes
3answers
71 views

Is it risky to URL-encode characters in an already URL-encoded string?

I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
0
votes
2answers
45 views

is encoding the same as encryption for malware obfuscation?

I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it ...
0
votes
3answers
128 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
0answers
93 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
0
votes
1answer
66 views

Odd characters — including a backslash — in magstripe track 1 name field?

I've been in the Point of Sale industry for decades. Parsing card magnetic stripe track 1 data has never been difficult, but lately we've started to see some odd data in the name field of cards that ...
0
votes
1answer
32 views

Problem identifying this encoding schematic into plain text

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
0
votes
2answers
1k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
3
votes
2answers
398 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
3
votes
1answer
96 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
0
votes
1answer
110 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
1answer
253 views

ASN.1 encoding of X25519 private key

I'm using mbed TLS for ECDH key agreement using Curve25519. The private and public keys are stored and transmitted as Hex strings as easily generated with mbed TLS. Those strings are big-endian. This ...
0
votes
1answer
50 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
1
vote
0answers
57 views

Server improperly handling unicode characters?

So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding ...
4
votes
1answer
179 views

Hydra - Attacking when login page encodes the username and password

I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password. I am unable to ...
0
votes
0answers
27 views

Is there a way to detect the encoding algorithm of a string? [duplicate]

I need something like hash-identifier tool, but for encoding schemes. Is there a similar tool out there?
2
votes
0answers
255 views

Security risks with pdf files in object tag at client/server side

This is my situation: a user uploads a pdf file to my server. The data travels encoded in base64 (like a regular input in a form). The base64 is saved in one particular file on my server. Now, another ...
0
votes
0answers
250 views

Single and double URL encoding tamper scripts and sqlmap

I am trying to understand how sqlmap tamper scripts work, and when each one of them is able to bypass certain custom filters. In the following code after the POST parameter is filtered for strings ...
22
votes
1answer
3k views

When and why does bypassing XSS sanitizers with double encoding work?

I have read in different sites about different ways to bypass XSS sanitizers, like double encoding special characters such as /<>:"', or employing different encoding schemes. However most of ...
0
votes
2answers
350 views

Is it safe to get html encoded data from database to prevent stored XSS attack?

for security purpose now i'm fetching all data from database with htmlEncoded format. it is correct? please help..
1
vote
0answers
59 views

Exploiting XSS when attack vector is passed in Javascript context after being HTML encoded?

My attack vector is being passed in three contexts. HTML element: <p>injection</p> HTML attribute value: <input value="injection"> Javascript: <script> var a = "...
0
votes
0answers
402 views

Should Content-Encoding deflate be disabled [duplicate]

After scaning web page with Nikto I have results that is "The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack." How to verify if that ...
4
votes
1answer
403 views

Why context sensitive encoding to prevent XSS?

OWASP recommends that context-sensitive encoding needs to be done. Please help me in getting a couple of strong "code examples" on why context sensitive based encoding needs to be done and why HTML ...
8
votes
3answers
2k views

How is character encodings used to bypass XSS sanitizers?

I read in different blogs that PHP htmlspecialchars() function has certain problems when one does not give the expected charset as an optional parameter. Can someone explain some basic stuff about ...
2
votes
1answer
67 views

Decoding requests from potentially malicious Android app

I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite. I noticed one of our devices was sending requests to a ...
2
votes
1answer
86 views

Does the ECDSA signature value (of an OCSP response) need to be DER encoded

In OCSP responses by a certain eIDAS PKI I every once in a while get signature values which, when unpacked from their BIT STRING, contain an ECDSA signature whose INTEGER constituents have an ...
0
votes
1answer
263 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
0
votes
2answers
190 views

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

I have QWERT keyboard, but I have set the keyboard settings in Windows to DVORAK. So if I type "test" it comes out as "y.oy". Would the key logger log "test" or "y.oy" in its records?
2
votes
1answer
527 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
4
votes
1answer
2k views

Bypassing browsers URL encoding to do reflected XSS from query parameter?

I tried to get reflected XSS in vulnerable website with a request to the following URL: https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)> The browser URL encode the ...
2
votes
3answers
114 views

What are some potential attacks that could be done to a website that doesn't manage url-encoding properly?

A month or so ago I was in the middle of one of my "Distributed Applications" classes and the professor was explaining us how to """properly""" authenticate users in a server. To demonstrate how to ...
2
votes
1answer
225 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
0
votes
2answers
199 views

padding problem in sha-1 hashed password

For my own understanding of Websphere LTPA keys, I'm running this Java code, which works correctly when using the author's Base64 encoded, SHA1 hashed password: String ltpa3DESKey = "...
0
votes
1answer
566 views

Explanation of illegal multi-byte encoding leading to XSS

I'm reading this report on unicode security and found the following paragraphs confusing: When converting from a multi-byte encoding, a byte value may not be a valid trailing byte, in a context ...
0
votes
1answer
156 views

What type of encoded text is this and how can I translate it? [duplicate]

I have no experience, but I've been playing a game and it's rather interesting. One of the character files has a long line of scrambled text and I was wondering if someone could tell me if it's ...
1
vote
0answers
92 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
1
vote
1answer
641 views

Does storing Base64 encoding of scrypt password hash make it more vulnerable?

Scrypt produces a binary hash of a password. Instead of storing it as bytes directly, we are considering to store the Base64 encoding of this string. Would that make the password hash more vulnerable ...
0
votes
0answers
312 views

What are the risk implications of allowing double encoded cookie values?

When a third party script executed within the same site for tracking purposes creates a persistent or tracking cookie most often as supercookie on *.example.com google analytics is an example but it ...
1
vote
0answers
399 views

prevent CRLF Injection using encoding

I read in a lot of articles including this and this one that we should always use a function to encode the CR and LF special characters to prevent CRLF Injection, but AFAIK to perform this attack ...
2
votes
2answers
226 views

why is it insecure to use userdata in url parameter names?

On the OWASP site on XSS it says that it is safe to put userdata in GET parameter values when encoded. However, userdata should not be used anywhere else, so not in the scheme, the domain or ...
0
votes
1answer
182 views

Mov byte to addres inside a register

I am trying to write a shell insertion decoder (my encoder works as expected). But when I try to move one byte to the address inside a register i face a Segmentation fault. The error happens in this ...
4
votes
1answer
953 views

Function of %5c.. in a path traversal

I've recently come across this blog post of a bug bounty hunter. Apparently, a path traversal vulnerability was discovered, which looked like this: http://help.example.com/@app/skin/views/%5c../%5c....
1
vote
3answers
437 views

Is this filter safe enough to mitigate XSS?

I have an application that escapes the following special characters. & < > " ' The application heavily displays HTTP request parameters throughout the application. The request parameters ...
0
votes
2answers
349 views

Is javascript HtmlEncode at output considered dangerous?

I've read some time ago that htmlEncoding in javascript is a no-go. But that is the case when you first encode the data and then save it in db (for example). In this case, you only rely on javascript ...
0
votes
2answers
129 views

How safe is to store a AES encoded password into a file?

Basically, I'm considering to store an AES-Base64 encoded password into a hidden file, with a 600 permission, into a uncommon location of a Unix/Linux server. That password would be used by an ...
0
votes
0answers
44 views

Odd network traffic: need help to find data payload. How can I find encoding of unknown binary data? [duplicate]

I have a capture of some odd traffic. There are many packets which seem to have a payload with the same encoding. The binary data seems to be an ASCII representation of hex, and I can't figure out how ...
3
votes
1answer
444 views

Directory traversal only works with URL-encoded “%00” char in the end

I found a site, using acunetix, with a POST form which is possible to see plain text files, basically it's a directory traversal vulnerability, but the curious thing is that it only works when I add a ...
1
vote
0answers
111 views

Storing salted&hashed passwords - file encoding/encryption?

Setup: Say I'm properly generating a password hash (e.g., concatenating it with a /dev/urandom salt and a local secret and hashing it with bcrypt), now I go to store the result in a "user information" ...
1
vote
1answer
2k views

How to correctly escape a string from an input field, preventing XSS attacks in JavaScript

I have a tiny application and I've read a lot about XSS, so I want to sanitize the one input that I have. When googling, I came across the OWASP guide stating that the following should be used to ...
1
vote
0answers
53 views

Get encoded content embedded in html page

I'm writing in order to ask for some help or advice regarding my problem. The trouble i'm facing is the following: Exploiting a path traversal on a local testing machine, i was able to get a bunch of ...
1
vote
2answers
117 views

How can I determine what encoding is being used? [duplicate]

I'm testing a webapp as part of a bug bounty program where the value of a product ticket given to clients is being encoded. FYI, ticket number is given to an user for an adquired product. Webapp has ...